# Node Registry — Canonical Source of Truth
> **Classification**: NEED_TO_KNOW — LOCAL ONLY
> **Version**: 1.0
> **Updated**: 2026-07-02
> **Authority**: This is the SINGLE canonical source for node identity. All other documents MUST reference this file. If any document contradicts this registry, THIS FILE IS CORRECT.

---

## Active Nodes (8)

| # | Node ID | Role | Public IP | WG IP | SSH Port | OS | Location | Provider | Server Name (Panel) | OS Hostname | DNS PTR | Tool Dir | Status |
|---|---------|------|-----------|-------|----------|-----|----------|----------|---------------------|-------------|---------|----------|--------|
| 001 | 199335 | DNS | 80.78.19.57 | 10.69.69.5 | 9922 | Ubuntu 24.04.4 | Sweden | Njalla | `p3plcpnl0842` | `504e1339.host.njalla.net` | `504e1339.host.njalla.net` | `/opt/unbound/tools/` | ACTIVE |
| 002 | 244939 | Proxy | 107.189.23.194 | 10.69.69.3 | 9922 | AlmaLinux 9.7 | Holland | Cloudzy | `srv244939` | `srv244939.hostlocal.net` | `srv244939.hostlocal.net.hopkraft.nl` | `/opt/cache-daemon/tools/` | ACTIVE |
| 003 | 333941 | Filter | 91.229.239.29 | 10.69.69.4 | 9922 | AlmaLinux 9.8 | Moldova | AlexHost | `s1.devtools.net` | `s1.devtools.net` | N/A | `/opt/netfilter/tools/` | ACTIVE |
| 004 | 414342 | Shield | 194.36.190.111 | 10.69.69.1 | 9922 | AlmaLinux 9.7 | Holland | HostSailor | `vps-82a41f.hosted-by.app` | `vps1178680.hostsailor.com` | — | `/opt/apache/engine/tools/` | ACTIVE |
| 005 | 558201 | Origin | 89.127.235.207 | 10.69.69.2 | 9922 | AlmaLinux 9.8 | Iceland | 1984.hosting | `vpsux9smjh` | `s1.cleanearth.cc` | `89.127.235.207.1984.is` | `/opt/php-worker/tools/` | ACTIVE |
| 006 | 669427 | Engine | 76.13.222.157 | 10.69.69.6 | 9922 | AlmaLinux 9.8 | Malaysia | Hostinger | `srv1653421.hstgr.cloud` | `srv1653421.hstgr.cloud` | `srv1653421.hstgr.cloud` | `/opt/apache/engine/tools/` | ACTIVE |
| 007 | 714820 | Payment | 45.143.166.118 | 10.69.69.7 | 9922 | AlmaLinux 9.6 | Holland | BlueVPS | `srv156742.hosttoname.com` | `srv156742.hosttoname.com` | — | `/opt/systemd-journal/tools/` | ACTIVE |
| 008 | 869377 | Vault | 104.194.144.66 | 10.69.69.8 | 9922 | AlmaLinux 9.7 | London | Cloudzy | `vps-c91b28.cloudzy.com` | `vps-c91b28.cloudzy.com` | — | `/opt/stunnel/tools/` | ACTIVE |

## SSH Access

| Key File | User | Node |
|----------|------|------|
| `Y:\keys\new\gabriella` | `admin` | ALL nodes (automation/tooling) |
| `Y:\keys\new\1.ppk` | `administrator` | DNS (199335) |
| `Y:\keys\new\2.ppk` | `administrator` | Proxy (244939) |
| `Y:\keys\new\3.ppk` | `administrator` | Filter (333941) |
| `Y:\keys\new\4.ppk` | `administrator` | Shield (414342) |
| `Y:\keys\new\5.ppk` | `administrator` | Origin (558201) |
| `Y:\keys\new\6.ppk` | `administrator` | Engine (669427) |
| `Y:\keys\new\7.ppk` | `administrator` | Payment (714820) |
| `Y:\keys\new\8.ppk` | `administrator` | Vault (869377) |

> `admin` uses `gabriella` key ONLY. `administrator` uses per-node PPK keys ONLY. NEVER mix these.

## Session Check-In Commands

| Node | Check-In | Goodbye |
|------|----------|---------|
| Shield (414342) | `sudo /opt/apache/engine/tools/coredump-handler.sh check-in "maintenance" "node" 3600` | `sudo /opt/apache/engine/tools/coredump-handler.sh goodbye` |
| Origin (558201) | `sudo /opt/php-worker/tools/nginx-maint.sh check-in "maintenance" "node" 3600` | `sudo /opt/php-worker/tools/nginx-maint.sh goodbye` |
| Proxy (244939) | `sudo /opt/cache-daemon/tools/networkd-diag.sh check-in "maintenance" "node" 3600` | `sudo /opt/cache-daemon/tools/networkd-diag.sh goodbye` |
| Filter (333941) | `sudo /opt/netfilter/tools/journal-compact.sh check-in "maintenance" "node" 3600` | `sudo /opt/netfilter/tools/journal-vacuum.sh` |
| DNS (199335) | `sudo /opt/unbound/tools/resolved-sync.sh check-in "maintenance" "node" 3600` | `sudo /opt/unbound/tools/resolved-sync.sh goodbye` |
| Engine (669427) | `sudo /opt/apache/engine/tools/oomd-report.sh check-in "maintenance" "node" 3600` | `sudo /opt/apache/engine/tools/oomd-cleanup.sh` |
| Payment (714820) | `sudo /opt/systemd-journal/tools/journal-rotate.sh check-in "maintenance" "node" 3600` | `sudo /opt/systemd-journal/tools/journal-archive.sh` |
| Vault (869377) | `sudo /opt/stunnel/tools/cert-renew-check.sh check-in "maintenance" "node" 3600` | `sudo /opt/stunnel/tools/cert-renew-check.sh goodbye` |

## Stale IDs — DO NOT USE

| Stale Value | Was Used In | Correct Value |
|-------------|-------------|---------------|
| `889201` (Payment node_id) | System_Architecture.md, NTK line 9 | `714820` |
| `298136` (Vault node_id) | System_Architecture.md | `869377` |
| `773816` (Email node_id) | ROUTE_MAP.md | DECOMMISSIONED — no replacement |
| `10.69.69.9` (Payment WG IP) | System_Architecture.md, NTK line 9 | `10.69.69.7` |
| `92.113.124.34` (old Shield IP) | ROUTE_MAP.md | `194.36.190.111` |
| `33022` (old SSH port) | SCHEMA_MAP.md default | `9922` |

## Stripe Architecture

- **Stripe API key**: Stored ENCRYPTED on **Payment node (714820)** at `/opt/payment/config/.stripe_key`
- **Decryption key**: Stored on **Vault node (869377)**, accessed via dedicated Payment↔Vault WG tunnel
- **IP restriction**: Stripe key is IP-locked to Payment node's public IP (`45.143.166.118`) via Stripe Dashboard
- **NO Stripe credentials exist on any other node** — not Engine, not Origin, not Shield

## Fleet Key (Origin)

| Property | Value |
|----------|-------|
| Path | `/var/www/private/keys/fleet` |
| Owner | `root:nginx` |
| Mode | `640` (`rw-r-----`) |
| Why nginx | PHP-FPM runs as `nginx` user — needs read access for fleet relay |
| Verify | `ls -la /var/www/private/keys/fleet` → must show `-rw-r----- root nginx` |

> [!CAUTION]
> If the key is `root:root 600`, PHP-FPM cannot read it. ALL fleet commands fail **silently** — no error shown to user.
